|
<br />Master Services and Purchasing Agreement
<br />
<br />Version: 24
<br />Release Date: August 2025 Page 35 of 42
<br />in Schedule 1 Details of the Processing, to this Appendix.
<br />6. Security. Axon will implement commercially reasonable and appropriate measures to secure Customer Data
<br />against accidental or unlawful loss, access, or disclosure. Axon will maintain a comprehensive information security
<br />program to protect Customer Data including logical, physical access, vulnerability, risk, and configuration
<br />management; incident monitoring and response; security education; and data protection. Axon will not treat
<br />Customer Data in accordance with FBI CJIS Security Policy requirements and does not agree to the CJIS Security
<br />Addendum for this engagement or any other security or privacy related commitments that have been established
<br />between Axon and Customer, such as ISO 27001 certification or SOC 2 Reporting.
<br />7. Privacy. Customer use of My90 is subject to the My90 Privacy Policy, a current version of which is available at
<br />https://www.axon.com/legal/my90privacypolicy. Customer agrees to allow Axon access to My90 Non-Content
<br />Data from Customer to (a) perform troubleshooting, maintenance, or diagnostic screenings; (b) provide, develop,
<br />improve, and support current and future Axon products including My90 and related services; and (c) enforce this
<br />Agreement or policies governing the use of My90 or other Axon products.
<br />8. Location of Storage. Axon may transfer Customer Data to third-party subcontractors for Processing. Axon will
<br />determine the locations for Processing of Customer Data. For all Customer, Axon will Process and store Customer
<br />Data within the country in which Customer is located. Ownership of My90 Customer Content remains with
<br />Customer.
<br />9. Required Disclosures. Axon will not disclose Customer Data that Customer shares with Axon except as
<br />compelled by a court or administrative body or required by any law or regulation. Axon will notify Customer if any
<br />disclosure request is received for Customer Data so Customer may file an objection with the court or
<br />administrative body, unless prohibited by law.
<br />10. Data Sharing. Axon may share data only with entities that control or are controlled by or under common control
<br />of Axon, and as described below:
<br />10.1. Axon may share Customer Data with third parties it employs to perform tasks on Axon’s behalf to provide
<br />products or services to Customer.
<br />10.2. Axon may share Aggregated Survey Response with third parties, such as other Axon customers, local city
<br />agencies, private companies, or members of the public that are seeking a way to collect analysis on general
<br />policing and community trends. Aggregated Survey Response will not be reasonably capable of being
<br />associated with or reasonably linked directly or indirectly to a particular individual.
<br />11. License and Intellectual Property. Customer grants Axon, its affiliates, and assignees the irrevocable,
<br />perpetual, fully paid, royalty-free, and worldwide right and license to use Customer Data for internal use including
<br />but not limited to analysis and creation of derivatives. Axon may not release Customer Data to any third party
<br />under this right that is not aggregated and de-identified. Customer acknowledges that Customer will have no
<br />intellectual property right in any media, good or service developed or improved by Axon. Customer acknowledges
<br />that Axon may make any lawful use of My90 Data and any derivative of Customer Data including, without
<br />limitation, the right to monetize, redistribute, make modification of, and make derivatives of the surveys, survey
<br />responses and associated data, and Customer will have no intellectual property right in any good, service, media,
<br />or other product that uses My90 Data.
<br />12. Customer Use of Aggregated Survey Response. Axon will make available to Customer Aggregated Survey
<br />Response and rights to use for any Customer purpose.
<br />13. Data Subject Rights. Taking into account the nature of the Processing, Axon shall assist Customer by appropriate
<br />technical and organizational measures, insofar as this is reasonable, for the fulfilment of Customer's obligation to
<br />respond to a Data Subject Request regarding any Personal Data contained within My90 Customer Content. If in
<br />regard to My90 Customer Content, Axon receives a Data Subject Request from Customer's data subject to
<br />exercise one or more of its rights under applicable Data Protection Law, Axon will redirect the data subject within
<br />seventy-two (72) hours, to make its request directly to Customer. Customer will be responsible for responding to
<br />any such request.
<br />14. Assistance with Requests Related to My90 Customer Content. With regard to the processing of My90
<br />Customer Content, Axon shall, if not prohibited by applicable law, notify Customer without delay after receipt, if
<br />Axon: (a) receives a request for information from the Supervisory Authority or any other competent authority
<br />regarding My90 Customer Content; (b) receives a complaint or request from a third party regarding the obligations
<br />of Customer or Axon under applicable Data Protection Law; or (c) receives any other communication which directly
<br />or indirectly pertains to My90 Customer Content or the Processing or protection of My90 Customer Content. Axon
<br />157
|